PT-2025-48566 · Grav · Grav Admin Plugin+1

Published 2025-12-01 · Updated 2025-12-04 · CVE-2025-66307

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27 Grav versions prior to 1.11.0-beta.1

Description The Grav admin plugin, a user interface for configuring Grav, contains a flaw in its "Forgot Password" functionality. Specifically, the functionality at the /admin/forgot endpoint reveals information about valid usernames and their corresponding email addresses through differing server responses. This allows an attacker to identify existing users and obtain their email addresses, potentially enabling attacks like password spraying, phishing, or social engineering.

Recommendations Update Grav to version 1.8.0-beta.27 or later. Update Grav to version 1.11.0-beta.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2025-66307

GHSA-Q3QX-CP62-F6M7

Affected Products

Grav

Grav Admin Plugin

References · 10

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-q3qx-cp62-f6m7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66307.json · Exploit
• https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0 · Patch
• https://osv.dev/vulnerability/CVE-2025-66307 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66307 · Security Note
• https://twitter.com/dailycve/status/1996393730333643147 · Twitter Post
• https://twitter.com/VolerionSec/status/1995619288934162742 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1995678743860236743 · Twitter Post
• https://twitter.com/CVEnew/status/1995617672420036964 · Twitter Post
• https://t.me/CVEtracker/38598 · Telegram Post